3 ms·

For my router PC, I run vyos [1]. Dinky little 9th gen Core i3 machine, but consumes <9W and easily handles gigabit throughput, even with Wireguard. For those i

For my router PC, I run vyos [1]. Dinky little 9th gen Core i3 machine, but consumes <9W and easily handles gigabit throughput, even with Wireguard. For those in the US with an AT&T fiber GPON ONT, vyos' 802.1x EAP-TLS implementation is complete enough where the certs can just be imported and things will work without obscure hacks (for those not familiar with AT&T fiber, this is to connect your own router directly to the fiber ONT, bypassing the bundled router). Everything else is on a separate server running Fedora. I used to run applications inside k3s, but got tired of the constant 10% CPU usage from the control plane trying to keep track of its state. Also didn't like that the containers I used weren't being rebuilt for security updates in packages (eg. openssl). Now, I just use plain old RPMs inside VMs. The stuff I run: * [Host] ssh: For CLI access and git hosting (just `git init --bare`; no fancy UIs like Gitea or Gitlab). * [Host] samba: For all file access. * [Host] zrepl: For zfs snapshot replication. * [Host] syncthing: For syncing KeePass databases. Also for syncing pictures from my phone. * [VM] jellyfin: For easy access to rips of my physical media collection. VFIO is very unstable with the 13th gen iGPU on my hardware, so I custom ffmpeg wrapper that SSH's back into the host for remote transcoding in a bwrap sandbox. * [VM] pdns-auth + dnsdist: The powerdns authoritative server handles the internal DNS. I have DNSSEC set up and SSHFP records for everything, so I don't need to worry about ~/.ssh/known_hosts. All of my computers that rely on this run systemd-resolved and do the DNSSEC validation locally. I run a daemon [2] on every host, which handles pushing new A/AAAA records via TSIG signed updates to the DNS server. dnsdist acts as a proxy which only allows access to the specific TXT record needed for ACME DNS challenges originating from Let's Encrypt's IP addresses. I may switch to a custom CA in the future when the name contraints x509 extension is better supported (so that a custom CA wouldn't be able to issue trusted certificates for domains that aren't mine). * [VM] miniflux: For RSS. * [VM] unifi-controller: For managing Ubiquiti wireless APs. [1] https://vyos.org/ https://vyos.org/ [2] https://github.com/chenxiaolong/ddns-updater https://github.com/chenxiaolong/ddns-updater

jum4 4y ago
Do you have more information about GPON from AT&T? Here in Germany I have seen only authentication based on the GPON SFP serial number and not with EAP-TLS.
- chenxiaolong 4y ago
  Yeah，AT&T unfortunately tries really hard to make their customers use the provided routers. For customers on the older GPON network (like myself), they provide an ONT and a router. The ONT will not communicate until the router authenticates with EAP-TLS. The ONT has some additional funkiness, like requiring the EAP-TLS ethernet frames be tagged with VLAN ID 0. Some folks work around this by using a ONT <-> dumb/unmanaged switch <-> router setup. They'll plug in the provided router, wait for it to authenticate, disconnect it, and then plug in their own router. The dumb switch will keep the link alive from the ONT's point of view. Works well, though it is annoying to have to redo the procedure whenever the power goes out. For the lucky folks whose provided routers are easily jailbreakable, we can extract the EAP-TLS certs and configure our own routers to authenticate directly. On their newer XGS-PON network, some folks found out that the EAP-TLS isn't even enforced by the ISP's network--it's enforced locally by the ONT. So you can buy your own SFP ONT module that doesn't support the OMCI commands for enabling EAP-TLS, spoof the SFP serial number, and get connected.

jum4 4y ago

Do you have more information about GPON from AT&T? Here in Germany I have seen only authentication based on the GPON SFP serial number and not with EAP-TLS.

chenxiaolong 4y ago
Yeah，AT&T unfortunately tries really hard to make their customers use the provided routers. For customers on the older GPON network (like myself), they provide an ONT and a router. The ONT will not communicate until the router authenticates with EAP-TLS. The ONT has some additional funkiness, like requiring the EAP-TLS ethernet frames be tagged with VLAN ID 0. Some folks work around this by using a ONT <-> dumb/unmanaged switch <-> router setup. They'll plug in the provided router, wait for it to authenticate, disconnect it, and then plug in their own router. The dumb switch will keep the link alive from the ONT's point of view. Works well, though it is annoying to have to redo the procedure whenever the power goes out. For the lucky folks whose provided routers are easily jailbreakable, we can extract the EAP-TLS certs and configure our own routers to authenticate directly. On their newer XGS-PON network, some folks found out that the EAP-TLS isn't even enforced by the ISP's network--it's enforced locally by the ONT. So you can buy your own SFP ONT module that doesn't support the OMCI commands for enabling EAP-TLS, spoof the SFP serial number, and get connected.